CVE-2026-62129
CriticalCVSS 9.9Summary
Arbitrary file upload vulnerability allowing a Contributor user to upload arbitrary files in the Creator LMS plugin in versions up to and including 1.2.21. A low-privileged user can upload arbitrary files to the server. This may lead to malicious code execution.
Risk Assessment
An attacker with a Contributor account can upload malicious files, potentially leading to remote code execution and server takeover. Organizations using this plugin are at risk of privilege escalation.
Recommendation
Update the Creator LMS plugin to the latest version that does not contain the vulnerability. If updating is not possible, restrict file upload capabilities for Contributor users.
Other vulnerabilities in Creator LMS
See all- CVE-2026-97244High
The Creator LMS plugin in versions up to and including 1.2.19 contains a Path Traversal vulnerability exploitable by a user with Contributor privileges.
- CVE-2026-62083Medium
Creator LMS plugin version 1.2.19 and earlier contains an 'Other Vulnerability Type' vulnerability exploitable by subscribers, allowing unauthorized actions.
- CVE-2026-62128Medium
A missing authorization vulnerability in Creator LMS allows exploiting incorrectly configured access control security levels. Affects versions from n/a through 1.2.21.
- CVE-2025-69359Medium
The Creator LMS plugin (WPFunnels) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Creator LMS from n/a through version 1.1.12.
Original NVD description (English source)
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS